Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-08-2024 04:24

General

  • Target

    13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe

  • Size

    1.8MB

  • MD5

    113bc038fe84de38995f20642177dc1e

  • SHA1

    faffde07789a90122d2480a0396b994d65e31c4d

  • SHA256

    13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065

  • SHA512

    4fb3622a05bb899f343c0eab645a1802c8f8f4213344540ae8a7982ad7ff4f68193f1c6968c4962412e6d00d619884ec0f3013ca5ae2ce857ce42d9184659660

  • SSDEEP

    24576:quV4CKl9kAHhTZ8VK5201kNSuYSmNVcZzehy2to2vx/BN29CQsAC8QqkNXW4sJRg:quV4NoOhN8/NwJXcZsy+VOkHMkNgJR

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

nord

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

kora

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe
    "C:\Users\Admin\AppData\Local\Temp\13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe
        "C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1696
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:5032
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:4996
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                  PID:2896
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:3012
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1424
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
                      6⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2464
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {120ed890-c3b3-45cb-ba50-d2579aebe862} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" gpu
                        7⤵
                          PID:4404
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2074694b-ee70-4721-b039-482a5789a53a} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" socket
                          7⤵
                            PID:3160
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2824 -childID 1 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a2db6a2-4684-4d90-affa-ee4372c863f2} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                            7⤵
                              PID:3792
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3344 -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 3428 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {487c61af-c96c-4746-9f53-f9c318f17330} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                              7⤵
                                PID:756
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4424 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f074691-67c3-4870-a6e2-541c4c08afe0} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" utility
                                7⤵
                                • Checks processor information in registry
                                PID:2948
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 3 -isForBrowser -prefsHandle 5540 -prefMapHandle 5480 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c26f9a22-6455-420a-9197-ec1613754497} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                                7⤵
                                  PID:336
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5680 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd61c60e-ad31-433a-8418-9f2a1e9f2604} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                                  7⤵
                                    PID:1588
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5572 -prefMapHandle 5560 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2f8020d-c0f9-42fc-8954-018e68346f7b} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                                    7⤵
                                      PID:4484
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6264 -childID 6 -isForBrowser -prefsHandle 6208 -prefMapHandle 6272 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 1012 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {759c27cb-0a91-4f66-a8c9-f3145b256887} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" tab
                                      7⤵
                                        PID:2964
                              • C:\Users\Admin\1000037002\f08a015692.exe
                                "C:\Users\Admin\1000037002\f08a015692.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:340
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2204
                              • C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe"
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3260
                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1628
                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4116
                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3396

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\1000037002\f08a015692.exe

                            Filesize

                            207KB

                            MD5

                            84f6ebedcc92bf18d5f52eef5055bd03

                            SHA1

                            ac5796ab6a6c5221b3e6a35a582ad57f8703b477

                            SHA256

                            4c947aa4de82538d4fd7e4f3bc3b6fca0fbd4dda8b5697deec2241a3765741ad

                            SHA512

                            22031302adfeebd2765d30e26556bc1817f89c8bcd452d2b6cbeae4ffe5c80b61f333822ea25bd297df45fdb57f82321a4f5441792e49b1b8b1f261d0ff1f311

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\activity-stream.discovery_stream.json

                            Filesize

                            41KB

                            MD5

                            2002288021f3fa022861caff997ef89a

                            SHA1

                            ee56bb5d0d839706e76a0ead303a2eaab9418b54

                            SHA256

                            136d7b71cf032eb3332ce56b9d3448b5c05116483ec5a85bf95f79c48e9cd58c

                            SHA512

                            503dc79c7d3899815f3b6697a336166e7e5cb22f73a2a441a42c0b7c75cdc75c1995b0df58ab1fcdadd642ea833c0bd54e077beb56bd8fe83e736465dee09797

                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x698r3gu.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                            Filesize

                            13KB

                            MD5

                            1ec9ba6b2424859ac85b7f3dee5607ae

                            SHA1

                            59b0fdd57b39c8a9ab7e1fce6a4abccbd1f3b464

                            SHA256

                            50da7332cce386761e4f6beaccfc93d20f9bf22875248b2c8d0839c51cff7879

                            SHA512

                            4ba31b48b0b7b8b421dd8271ddf9583114d6754d40f91a86724295683371a73a1f77fd51f22a13cda6df658b33ff528444f21593f1d3f83e76d74a6a576429f2

                          • C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

                            Filesize

                            1.8MB

                            MD5

                            113bc038fe84de38995f20642177dc1e

                            SHA1

                            faffde07789a90122d2480a0396b994d65e31c4d

                            SHA256

                            13c5f100e59b293b4b5362ff6d990ce784aa374f1615c0544ca9a3ecca40d065

                            SHA512

                            4fb3622a05bb899f343c0eab645a1802c8f8f4213344540ae8a7982ad7ff4f68193f1c6968c4962412e6d00d619884ec0f3013ca5ae2ce857ce42d9184659660

                          • C:\Users\Admin\AppData\Local\Temp\1000036001\ecde9732f4.exe

                            Filesize

                            1.2MB

                            MD5

                            a071730d9855b71c24be356e715bc481

                            SHA1

                            5889bb6a5f2884491dc6a47b5d5ab91d22296dea

                            SHA256

                            ea76ee73ec3bdc0ffdc801621f5c827c847dee2657700e7c5d73593587323323

                            SHA512

                            2a66103984a51f85eb5718169ed3fde288a45ae05ee3216b2da88f6fa3a4798256e6d9ed77f2482184f7390d7e41aa64f67e2c959f18e04e9a3f430658c830bd

                          • C:\Users\Admin\AppData\Local\Temp\1000038001\521782bbed.exe

                            Filesize

                            187KB

                            MD5

                            278ee1426274818874556aa18fd02e3a

                            SHA1

                            185a2761330024dec52134df2c8388c461451acb

                            SHA256

                            37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

                            SHA512

                            07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                            Filesize

                            479KB

                            MD5

                            09372174e83dbbf696ee732fd2e875bb

                            SHA1

                            ba360186ba650a769f9303f48b7200fb5eaccee1

                            SHA256

                            c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                            SHA512

                            b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                            Filesize

                            13.8MB

                            MD5

                            0a8747a2ac9ac08ae9508f36c6d75692

                            SHA1

                            b287a96fd6cc12433adb42193dfe06111c38eaf0

                            SHA256

                            32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                            SHA512

                            59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                            Filesize

                            7KB

                            MD5

                            1cef7d1d5751a04692bf5b4f21d86c0a

                            SHA1

                            8b32411582bd704c6d45da19e68c94e3c45a58ad

                            SHA256

                            d9269c94667ce8340c29b398084f8be61d77bceaad2a4a1ce16984940039eb8d

                            SHA512

                            0d630c90af33d2fb9a8501f3b3381bc59db1c8122ee0d2286b8b72bd83b310a81ec0bef49d389ae97213ebe70b4036d21f91a97abba8c28a423aafa9981f4646

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\AlternateServices.bin

                            Filesize

                            10KB

                            MD5

                            5ceec1c5f37a8621e3a736fb2cf2cb3b

                            SHA1

                            b1e99776a89b33e2a856c2267a92f4744946ec2f

                            SHA256

                            ef80a49ac427737cc94a835e8a8fb60d4738292e90f80c224446cd43c00acef5

                            SHA512

                            e25e618e644741f4fa541774da105bfc9e1d03365f27e83cece18abed2e7561cb7a7be61d66db63474d7ae358dfc72c5392a94d017f082126645a0169b35b854

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                            Filesize

                            5KB

                            MD5

                            9e89889161f0777de460242cd6ae398a

                            SHA1

                            7f2ea196b90e547c9130854efaccd96819a4693c

                            SHA256

                            88aa06f15b51e6ba2934f82e56a6cc41488d1ff073d0c7557612f7cde635d1c1

                            SHA512

                            d2eee98ae06f7dd27a371938e1deffd79267c7b49b21b7b99c12a98dd0a78adc1b310bb35d15273ad3577998577562b09dd9aa2ebb32f3db300be8060af84ca5

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                            Filesize

                            6KB

                            MD5

                            97e98fe9d99420cb2749931d113256cf

                            SHA1

                            f6fe185cbe585ee307f08a9b4ad4c76636bc12bb

                            SHA256

                            637d5229172a53ed29f9378825f74ecdf8ae5e8c940c8c04377755eaec6d21ea

                            SHA512

                            b1d820dcb88ee198f2842d90d080f71e10f999e7455ee5e7297a8cedd0b61bcd02587bd2d37397b9a90f420414c2673075363168efb5b044afe16954700c4252

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                            Filesize

                            16KB

                            MD5

                            642411ab8f4ba9e2f7492e62f7dd17e3

                            SHA1

                            d302291c5ecd78456a106b93c95907ba7e8534ed

                            SHA256

                            25464adb901bd51d1fc86a62105bc0e95bf7fd060183550e3608d80479b969ed

                            SHA512

                            6050e730e1f82f5f7121b67ac4b783a3db96a3e1efc799992d299e39f5ed2d0f798d3de86c6f9edd42dc86d00065cf2a9d0f90a3318e1f82710a8c62ba0cc017

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\db\data.safe.tmp

                            Filesize

                            16KB

                            MD5

                            092a0b17ca9848360937b9af52720e2a

                            SHA1

                            5d037c97ce8a1ddcce43f1dc82bdb914bbe19c1e

                            SHA256

                            ce46bf772c797e9462c853da8f8d50159a6092deff94aeae869d27afd5c0465a

                            SHA512

                            868b353200484528aea7603ffd5a82b074d4300a0d6db010b78cb09d8e4b22ba1f8ad5399e9955b886af8f69833d0d10db1a8b5a82f89292d5b29ac741e52b8f

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\36fc3e8e-32ec-4219-82d3-1e8dec5722da

                            Filesize

                            26KB

                            MD5

                            b5c15bf969247cd4ae09196e0b42fecf

                            SHA1

                            d961f7c2d01920d9f4194d200aedfe383e805a47

                            SHA256

                            8b3628e3d866f96af372ad19540f0480f34cc1c750e283c7a97bb25742b9e491

                            SHA512

                            7cf7880e29e38c47c8660cd9b2150be345f8e6d7d92e89674a9c06ccc4cf71a1f100c8a044d7cd4ba13033f5f487cea64eb0c53bd420565e9d484a5db8be89a3

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\9faec2b3-c184-46e2-9803-6cfd724a7859

                            Filesize

                            982B

                            MD5

                            b7ce4f8a62211f4ddd1f6aae6ce62a5c

                            SHA1

                            6963893d3a42758faae50c7c57cffd44f044961d

                            SHA256

                            accfbce38203fc33803e9438a56e858816495b3c1d945fb9865fad481cab4fed

                            SHA512

                            7d769859e85db8954e62e826331b389c2b0cf9f98e96d3004041bcda00c8282b78afdb38dffe8c25d6d5f5ce8333914d35d4bd46ed7817cc306af5e8d48765d4

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\datareporting\glean\pending_pings\debbfd7a-0300-40ab-a761-6fda52c9aa66

                            Filesize

                            671B

                            MD5

                            d2829631ae08d8959765cbc7d398509c

                            SHA1

                            57df353c16769786812c3e02f105fe01c5a52d03

                            SHA256

                            76d64d2ee16e83d8bfe00fed29ac6c7198a53c358c46523602b7ce87756caa8b

                            SHA512

                            2fe774d3ae3aa31fd086e0fd6652bb2872c791f3fd59f7063bef3d8b42643c6dc203c3e3e3c7fdd31398249510cb60312f8700b1009fc1c726b710d2c01c14b3

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                            Filesize

                            1.1MB

                            MD5

                            842039753bf41fa5e11b3a1383061a87

                            SHA1

                            3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                            SHA256

                            d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                            SHA512

                            d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                            Filesize

                            116B

                            MD5

                            2a461e9eb87fd1955cea740a3444ee7a

                            SHA1

                            b10755914c713f5a4677494dbe8a686ed458c3c5

                            SHA256

                            4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                            SHA512

                            34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                            Filesize

                            372B

                            MD5

                            bf957ad58b55f64219ab3f793e374316

                            SHA1

                            a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                            SHA256

                            bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                            SHA512

                            79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                            Filesize

                            17.8MB

                            MD5

                            daf7ef3acccab478aaa7d6dc1c60f865

                            SHA1

                            f8246162b97ce4a945feced27b6ea114366ff2ad

                            SHA256

                            bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                            SHA512

                            5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js

                            Filesize

                            11KB

                            MD5

                            c3bd9d954d883dd0f9006946fb30dd5e

                            SHA1

                            9c9871c6026fc5ab2e3c5ce212e810effebee3d8

                            SHA256

                            caffa5fa5f19dde0815f392ac825d9f46f48a464be19860bfde391d6975a3502

                            SHA512

                            c1f19b7b0a0f2c5887d152d549c5a002c6a4f3ae8f2a34573f9d50f8830ef4c02ffd3fd7b183157d242272e553c3193a2fe8301181ccd1e7a0d6389939a5e500

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js

                            Filesize

                            12KB

                            MD5

                            75e4ef88167248f2453284164326e055

                            SHA1

                            5b912f3af925c2e7a425e9b87231919d72665c16

                            SHA256

                            bd70eb4a57f7ef06403de2982b7debe29eb9a6e093fc158913e8533e69dd2f42

                            SHA512

                            ba95f512c2625bdb9178e81aca776bd02c2c05aa78338052aa684fc4a95c621bdc1685ee2a3e24e07a1fc5599f6aa6d8b55cbc7fdebb8cd548bb9d111c50e779

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs-1.js

                            Filesize

                            16KB

                            MD5

                            ea43aaf5ed148213c1198d5f13063dec

                            SHA1

                            1d61598584562623dded09e89d2b97afa25db935

                            SHA256

                            ed198b385ae68435119c04b967ec6cac26334968513ae84185e04acdd648b301

                            SHA512

                            bfd4e4872d51e8e05ebb6a1b5000f383cddf9a880568e6d4fe59cf99143c98e2afd3b16cf0125d354b88ac33d37165ac7389bd209445473b3fedd6b0a05ed879

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js

                            Filesize

                            16KB

                            MD5

                            b0cdd1d58e946df4a36eef864beb1867

                            SHA1

                            6dce001c571d01d7e9f555fbbdd524a170246a09

                            SHA256

                            b11ecf333d385bbdaf5280942d95e61eb8a77aae4dd4440beab9636c3d04d187

                            SHA512

                            d778a7814a3a7dc854a19fc2fd30ab63b1c2e8bf1df5e3738396b2c69a946e4c141b4752b8d048a4ea1faca40fa50ef4f8c7e181ad48ee827d6d9ff6b8a90afb

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\prefs.js

                            Filesize

                            10KB

                            MD5

                            492c78900c931a10cd90f04e78f9df4a

                            SHA1

                            38b5059d52125f0ed101d3606b187ca76276e6fc

                            SHA256

                            3b98e665bcbb6d6ba586455a81bdc7bcd706f8e89040fe2f7acbf83c3e99e4fb

                            SHA512

                            285a4da4bda0e20e73352c3353d0325ed65a4a5cad3ea531a64b3a7d434d9cdc03303a28f3423967029b4490019da067ebe2173ed9ca2ea9f0d185eb040b9f13

                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x698r3gu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                            Filesize

                            1.6MB

                            MD5

                            9fc2d176e9d9d959c1b5eec75aa8d36b

                            SHA1

                            5b5d163d92cbcb5454ed1f787e1963fa4b849f5f

                            SHA256

                            b2fdcb5245083fb0aaa39a7f5b1d18a619422b10cfb34e908656467023251d42

                            SHA512

                            a538f1a4c5dc42fc62eee797644181325036a3176e52d91b310cb9bf5cbf83e556bb83392d0f01466905da07229489696ce43347132b6c34b00618969e27db97

                          • memory/340-66-0x0000000000E40000-0x0000000000E7A000-memory.dmp

                            Filesize

                            232KB

                          • memory/1592-40-0x0000000072D5E000-0x0000000072D5F000-memory.dmp

                            Filesize

                            4KB

                          • memory/1592-41-0x00000000002A0000-0x00000000003D2000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/1628-360-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/1628-389-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2204-70-0x0000000000400000-0x0000000000643000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/2204-68-0x0000000000400000-0x0000000000643000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/3012-43-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/3012-45-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/3012-47-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                          • memory/3260-87-0x0000000000700000-0x0000000000943000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/3260-86-0x0000000000700000-0x0000000000943000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/3396-2606-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/3396-2599-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/3960-1-0x0000000077396000-0x0000000077398000-memory.dmp

                            Filesize

                            8KB

                          • memory/3960-2-0x00000000003A1000-0x00000000003CF000-memory.dmp

                            Filesize

                            184KB

                          • memory/3960-0-0x00000000003A0000-0x000000000084B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/3960-3-0x00000000003A0000-0x000000000084B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/3960-5-0x00000000003A0000-0x000000000084B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/3960-17-0x00000000003A0000-0x000000000084B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4116-2590-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4116-2588-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-456-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-19-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-454-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2593-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2591-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-455-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-1286-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2513-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2581-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-20-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-21-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-18-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-472-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2594-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2595-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2596-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2597-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-451-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-434-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2607-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4224-2608-0x0000000000390000-0x000000000083B000-memory.dmp

                            Filesize

                            4.7MB